Veeam and object-locking in S3

[t481]

Hello,
How does the object-locking feature work for immutable copies to S3 buckets?

I have the following (as an example):

Data is backed using a Daily backup job (Daily-Job) to SOBR-01
Backup copy (Daily-Job-Copy) creates a copy on SOBR-02 and sets retention for 2 recent copies and 4 weekly 6 monthly.
SOBR-02 has an immutable Cloudian Hyperstore bucket (S3) in the Capacity Tier

SOBR-02 is configured to "Copy backups to object storage as soon as they are created"
The bucket itself is set to "Make recent backups immutable for 30 days"

What I would expect is for the daily backups to be retained for 30 days in the S3 bucket from creation. However, that doesn't seem to be the case. I can only see Full copies for
Less than a day (increment)
1 day
5 days
12 days
17 days
26 days
47 days
75 days
110 days

Could someone please help explain what's happening?

Thank you in advance

[HannesK]

Hello,
the sticky FAQ topic has some information that the immutability period is extended every 10 days for objects that are still needed.

Immutability is minimum 30 days in your case. But it can also be up to 40 days (it's to optimize costs / performance).

I can only see Full copies for Less than a day (increment)

can you maybe explain more in detail what you mean here? each object has an immutable retention if it needs to be protected. If it is older, then less than 30 days "to go" are okay. I'm not sure what the list of days represents. There is only one "full backup", but it's tons of small objects, so I don't know how you can "see" it.

Best regards,
Hannes

[t481]

Hi @HannesK
I'm not talking about the objects. I'm referring to what I am able to see under Backups -> Object storage and job name.
I am aware of the additional 10 days but I expected the daily incremental backups to be stored in S3 for at least 30 days given the "Copy backups to object storage as soon as they are created" setting so I expect that when a backup is taken then the backup copy is created that that copy is copied to S3 and stored there for 30(40) days right?

[HannesK]

Hello,
yes, backups stay at least for 30 days in the immutable bucket.

With your retention for only 2 recent backups, you should see errors every day that it could not delete the objects because of object lock.

Something is wrong there. It's hard to guess the reason in the forum... could you please create a support case for further investigation and post the case number here?

Best regards,
Hannes

[t481]

Thanks. Will do.

[t481]

Veeam Support - Case # 04762375

[t481]

Apparently this is because the copy job is set to retain 2 recent copies and not 30. According to the support team, the data is still there because Veeam is unable to delete it but is not shown because they don't fall within the parameters of the retention of the backup copy job.

This looks like a potential bug or a missing feature. The data is immutable and therefore Veeam is not able to delete it for 40 days. Why not make it available so that I can use it to restore data from since I'm already using up the space. This feels like a complete waste. I don't know what others think?

[HannesK]

well, hiding data from the Backups -> Object storage section makes sense to me, because it makes little sense to show things that shouldn't be there (you configured 2 restore points retention)

Just to clarify: are there errors / warnings when the retention is applied? Because they should be there are far as I remember.

[veremin]

Also, a general question: what's the reason for having immutability period longer than job retention? The goal of Capacity Tier immutability to protect the most recent backups, so the recommend practice is to set immutability shorter that job retention. Thanks!

[HannesK]

I just saw in the case that the goal is to have two days in performance tier and move everything older to capacity tier.

This can be achieved fore example by the following ways
1) use reverse incremental. use copy & move and move after 2 days
2) use forward incremental with synthetic full every (second) day on REFS / XFS. I know customers doing that since we have "move".